# Current repository CI controls. This file lists only mechanisms and jobs that exist in this
# checkout. Build/release supply-chain, image, signing, provenance, SBOM, and tag-release jobs are
# intentionally absent until their later bounded reconstruction.
#
# Fields:
#   release_blocking: true, false, or conditional
#   mechanism: gradle-custom-task, gradle-plugin-task, contract-test, workflow-job,
#              or delegated-pending
#   ref: task, plugin@task, repository-relative test path below src/, or workflow job id
#   workflow/job: canonical workflow and job that execute or represent the control
#   execution: check (through Gradle check), explicit (named in the job), or job
gates:
  - id: format-lint
    release_blocking: true
    mechanism: gradle-plugin-task
    ref: com.diffplug.spotless@spotlessCheck
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: unit-and-contract-tests
    release_blocking: true
    mechanism: gradle-plugin-task
    ref: java@test
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: conditional-transport-qualification
    release_blocking: true
    mechanism: gradle-custom-task
    ref: conditionalTransportQualification
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: explicit
  - id: clean-architecture-dependencies
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyCleanArchitectureDependencies
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: environment-contract
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyEnvKeys
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: documented-leaf-count
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyDocumentedLeafCount
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: declared-dependency-absence
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyDependencyPolicy
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: notification-api-surface
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyNotificationApiSurface
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: notification-configuration-contract
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyNotificationConfiguration
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: notification-support-grade-evidence
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyNotificationEvidence
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: runbook-reference-drift
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyRunbookReferences
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: graphql-api-surface
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyGraphQlApiSurface
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: mongo-api-surface
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyMongoApiSurface
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  # The strongest evidence this repository produces, and CI does not run it. Fifteen Compose lanes
  # start real PostgreSQL, MongoDB, Kafka, MinIO, Mailpit and Keycloak, take a real client-credentials
  # JWT, and prove things no in-JVM test can: that all-off boots with no external resource, that the
  # notification handoff delivers exactly once across a restart on the same volume, that the startup
  # log is silent. It runs from a developer's machine via scripts/run-compose-runtime-smoke.sh and
  # from nowhere else — no workflow invokes it, so nothing re-runs it on a pull request.
  #
  # Registered delegated-pending so the gap is a tracked absence rather than an unstated one.
  # Executing it in CI needs a Docker-capable runner and a decision about the minutes fifteen
  # container lanes cost, which is an infrastructure choice rather than a wiring oversight.
  - id: runtime-smoke-matrix
    release_blocking: conditional
    mechanism: delegated-pending
    ref: runtime-smoke-matrix-lane
    workflow: ci-quality-gates.yml
    job: release-gate
    execution: job
  # `conditional-transport-qualification` above is the registered GraphQL control, and it is a
  # boundary test: a @SpringBootTest over a nested test application with in-memory Basic Auth. Its own
  # javadoc says so — "the nested application deliberately owns only test authentication and CORS
  # policy". That is a legitimate transport-boundary proof and it is not release evidence for the
  # security posture, which is the distinction the Definition of Done draws.
  #
  # The real proof exists: the local-graphql Compose lane obtains a Keycloak client-credentials token
  # and posts it to /graphql on the running bootJar, asserting that anonymous and malformed
  # credentials are refused and the authenticated query answers. It is part of the runtime smoke
  # matrix above, so it inherits that control's pending status rather than having none of its own.
  - id: graphql-runtime-jwt
    release_blocking: conditional
    mechanism: delegated-pending
    ref: graphql-runtime-jwt-lane
    workflow: ci-quality-gates.yml
    job: release-gate
    execution: job
  - id: one-type-per-file
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyOneTypePerFile
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: readme-command-drift
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyReadmeCommands
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: trivy-suppression-governance
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyTrivyignore
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: quarantine-sunset
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyQuarantineSunset
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: public-path-snapshot
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyPublicPathSnapshot
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: explicit
  - id: dependency-locks
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyDependencyLocks
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: explicit
  # Points at the inventory guard rather than at one suite. The 87 architecture rules used to be
  # 74-in-one-class plus a scattered remainder, so naming CleanArchitectureTest.java named most of
  # them and silently omitted the rest; after the split (BOOT-012) it would have named a fifth of
  # them. ArchRuleDiscoveryContractTest pins every rule in the package by name and fails if one is
  # declared where ArchUnit cannot discover it, which is the property this gate actually exists to
  # protect.
  - id: architecture-contract-test
    release_blocking: true
    mechanism: contract-test
    ref: app-bootstrap/src/test/java/dev/caskeleton/bootstrap/architecture/ArchRuleDiscoveryContractTest.java
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: sample-off
    release_blocking: true
    mechanism: gradle-custom-task
    ref: sampleOffTest
    workflow: ci-quality-gates.yml
    job: sample-off
    execution: explicit
  - id: gate-matrix-lint
    release_blocking: true
    mechanism: workflow-job
    ref: gate-matrix-lint
    workflow: ci-quality-gates.yml
    job: gate-matrix-lint
    execution: job
  - id: redis-sdk
    release_blocking: true
    mechanism: workflow-job
    ref: redis-sdk
    workflow: ci-quality-gates.yml
    job: redis-sdk
    execution: job
  - id: jpa-candidate-evidence
    release_blocking: true
    mechanism: workflow-job
    ref: jpa-candidate-evidence
    workflow: ci-quality-gates.yml
    job: jpa-candidate-evidence
    execution: job
  - id: jpa-r2-evidence
    release_blocking: conditional
    mechanism: workflow-job
    ref: jpa-r2-evidence
    workflow: jpa-r2-evidence.yml
    job: jpa-r2-evidence
    execution: job
  - id: quality-release-gate
    release_blocking: true
    mechanism: workflow-job
    ref: release-gate
    workflow: ci-quality-gates.yml
    job: release-gate
    execution: job
  - id: flaky-quarantine
    release_blocking: false
    mechanism: workflow-job
    ref: quarantine
    workflow: ci-quality-gates.yml
    job: quarantine
    execution: job
  - id: dependency-review
    release_blocking: conditional
    mechanism: workflow-job
    ref: dependency-review
    workflow: dependency-vulnerability.yml
    job: dependency-review
    execution: job
  - id: dependency-submission
    release_blocking: false
    mechanism: workflow-job
    ref: dependency-submission
    workflow: dependency-vulnerability.yml
    job: dependency-submission
    execution: job
  - id: filesystem-vulnerability-scan
    release_blocking: true
    mechanism: workflow-job
    ref: trivy-fs
    workflow: dependency-vulnerability.yml
    job: trivy-fs
    execution: job
  - id: documentation-links
    release_blocking: conditional
    mechanism: workflow-job
    ref: lychee
    workflow: link-check.yml
    job: lychee
    execution: job
  - id: object-storage-minio-managed-contract
    release_blocking: true
    mechanism: gradle-custom-task
    ref: objectStorageMinioContractTest
    workflow: object-storage-qualification.yml
    job: minio-managed-contract
    execution: explicit
  - id: poster-image-migration
    release_blocking: true
    mechanism: gradle-custom-task
    ref: posterImageMigrationTest
    workflow: object-storage-qualification.yml
    job: poster-image-v7-migration
    execution: explicit
  - id: object-storage-minio-managed-fault
    release_blocking: conditional
    mechanism: gradle-custom-task
    ref: objectStorageMinioFaultTest
    workflow: object-storage-qualification.yml
    job: minio-managed-fault
    execution: explicit
  - id: object-storage-aws-protected-qualification
    release_blocking: conditional
    mechanism: delegated-pending
    ref: approval-gate-b
    workflow: object-storage-qualification.yml
    job: aws-managed-common-subset
    execution: job
  - id: redis-sdk-support-matrix
    release_blocking: true
    mechanism: contract-test
    ref: adapter/outbound/cache-redis/src/test/java/dev/caskeleton/adapter/outbound/cache/redis/sdk/RedisSupportMatrixTest.java
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  # Promoted from delegated-pending: the workflow is no longer manual-only. A pull request that
  # touches the Redis leaf runs the standalone lane, and the full supported-version x topology
  # matrix runs nightly and on a release candidate. While it was dispatch-only, a release could
  # claim topology evidence that nobody had produced for that commit.
  - id: redis-sdk-topology-evidence
    release_blocking: conditional
    mechanism: workflow-job
    ref: topology-evidence
    workflow: redis-sdk-topology.yml
    job: topology-evidence
    execution: job
  - id: httpclient-stable-contract
    release_blocking: true
    mechanism: gradle-custom-task
    ref: httpClientStableContractTest
    workflow: httpclient-release.yml
    job: release-gate
    execution: explicit
  - id: httpclient-security-suite
    release_blocking: true
    mechanism: gradle-custom-task
    ref: httpClientSecurityTest
    workflow: httpclient-release.yml
    job: release-gate
    execution: explicit
  - id: httpclient-fault-injection
    release_blocking: true
    mechanism: gradle-custom-task
    ref: httpClientFailureInjectionTest
    workflow: httpclient-release.yml
    job: release-gate
    execution: explicit
  - id: httpclient-performance-certification
    release_blocking: true
    mechanism: gradle-custom-task
    ref: httpClientPerformanceTest
    workflow: httpclient-release.yml
    job: release-gate
    execution: explicit
  - id: httpclient-spring62-api-surface
    release_blocking: true
    mechanism: gradle-custom-task
    ref: spring62ApiSurfaceScan
    workflow: httpclient-release.yml
    job: release-gate
    execution: explicit
  # The 6.2 API-surface scan above proves the common packages compile against the older surface. It
  # does not prove they run on it, and the two were being conflated: a lane called
  # "spring62CompatibilityTest" reads as a runtime compatibility proof. The Gradle task is renamed to
  # say what it does, and the runtime claim is registered here as its own delegated-pending control
  # so the gap is a tracked absence rather than an unstated one. Executing it needs a Spring
  # Framework 6.2 distribution resolved into a separate test runtime, which this repository's
  # Boot 4.0 baseline does not carry.
  - id: httpclient-spring62-runtime
    release_blocking: conditional
    mechanism: delegated-pending
    ref: spring62-runtime-lane
    workflow: httpclient-release.yml
    job: release-gate
    execution: job
  - id: httpclient-spring70-compatibility
    release_blocking: true
    mechanism: gradle-custom-task
    ref: spring70CompatibilityTest
    workflow: httpclient-release.yml
    job: release-gate
    execution: explicit
  - id: httpclient-documentation-drift
    release_blocking: true
    mechanism: workflow-job
    ref: httpclient-documentation
    workflow: httpclient-release.yml
    job: httpclient-documentation
    execution: job
  - id: httpclient-event-loop-blocking
    release_blocking: true
    mechanism: gradle-custom-task
    ref: httpClientBlockHoundTest
    workflow: httpclient-release.yml
    job: release-gate
    execution: explicit
  # The messaging platform's only claim that needs a real broker to be true. The gate is the
  # evidence check rather than the lane, and it depends on the lane: passing means both that every
  # fault scenario produced the outcome the shared contract fixes and that the committed manifest is
  # what this run wrote. Before it existed, `CertifiedEvidence` was a hand-authored list and
  # "certified against a live broker" was a sentence a developer could type.
  - id: messaging-broker-certification
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyMessagingCertificationEvidence
    workflow: messaging-certification.yml
    job: broker-certification
    execution: explicit